Splunk Search

dropdown case to populate token

surekhasplunk
Communicator

Hi,

I have a dropdown with 5 values.
But in the following panel query the table and index which i am using has no reference to that above dropdown values.
So i have used makeresults to populate the token and use it in the query

Now how can i say if from dropdown A is choosen then taken token1 and if from dropwn B is choosen then use token2

I tried with a if and eval but thats not working can you may be help with the if condition here so that i can use the same token but gets populated accordingly or use a case statement

<form>
  <label>abc</label>
  <search>
    <query>|makeresults |eval cfd_hosts=if($infraname$="FRA-CLOUD GTS","SC2CLK-CLOUD-CFD-VDC2 OR host=SC2BJV-CLOUD-CFD-VDC2 OR host=DC2A4-CLOUD-CFD-VDC2",1 )| fields cfd_hosts
     </query>
    <done>
      <set token="tokField1">$result.cfd_hosts$</set>
    </done>
  </search>
  <search>
    <query>|makeresults |eval fra_bip_hosts="TIGR7-BIP-CFD-A2 OR host=TIGR4-BIP-CFD-A1 OR host=SC2CLK-SVC-CFD-A OR host=SC2ASV-SVC-CFD-A1" | fields fra_bip_hosts
     </query>
    <done>
      <set token="tokField2">$result.fra_bip_hosts$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="infraname" searchWhenChanged="true">
      <label>field1</label>
      <fieldForLabel>Infrastructure Name</fieldForLabel>
      <fieldForValue>Infrastructure Name</fieldForValue>
      <search>
        <query>|inputlookup temp_infraname.csv | table "Infrastructure Name"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$infraname$ choosen</title>
        <search>
          <query>| mstats max(_value) as Bits_in_sec where index=ehealth (host=$tokField2$) AND metric_name="*in"   
    by host,metric_name, info span=1d </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
Tags (3)
0 Karma

DavidHourani
Super Champion

Hi @surekhasplunk,

Seems like you're looking for conditional token behavior, have a look at the official documentation here there's a good example on how to use it :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/ContextualDrilldown#Configure_conditional_beh...
And here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/tokens#Conditional_operations_with_form_input...

You can use on change for each of your inputs so whenever one changes your token is set, so for the first input you would have:

  <change>
      <set token="yourtoken">$token1$</set>
  </change>

And the second as well but with token2:

  <change>
      <set token="yourtoken">$token2$</set>
  </change>

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...